Privacy policy

The data controller is FLY STEP di Giuseppe Panetta, with registered office at Via Umbria 7, 88821 Rocca di Neto (KR) – Italia.

For anything concerning your data you can write to flystep.general@gmail.com or to flystep@pec.it.

No data protection officer has been appointed, as the legal conditions requiring one do not apply.

• Contact and delivery details: first and last name, address, email, telephone number, any billing details.
• Order data: items purchased, amounts, date, shipping status, any returns.
• Payment data: handled directly by the payment providers. FlyStep does not store card numbers.
• Email address for the newsletter, if you choose to subscribe.
• Technical browsing data needed for the site to work.

• To perform the contract: handling your order, shipping it, assisting you, managing returns and refunds. Legal basis: Art. 6(1)(b) GDPR.
• To comply with legal obligations: invoicing, retention of accounting and tax records. Legal basis: Art. 6(1)(c) GDPR.
• To send you the newsletter: only if you subscribe. Legal basis: your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time.
• To establish or defend a legal claim, within the limits of legitimate interest. Legal basis: Art. 6(1)(f) GDPR.

Providing the data needed for an order is mandatory: without it we cannot conclude or perform the sale. Subscribing to the newsletter is entirely optional and does not affect your purchase.

Your data is never sold or passed to third parties for commercial purposes. It is shared only with those who help us run the shop, each in their own role:

• Shopify International Ltd. — e-commerce platform handling the catalogue, orders, checkout and customer list, as data processor.
• Vercel Inc. — hosting infrastructure for the website, as data processor.
• Couriers and logistics operators — for delivery and for collecting returns.
• Payment providers (including PayPal, Shop Pay, Google Pay and the card networks) — as independent controllers, under their own privacy notices.
• Our accountant — for statutory obligations.
• Public authorities, where required by law.

Some of the providers listed are based outside the European Economic Area or use infrastructure there. In those cases the transfer relies on European Commission adequacy decisions or on Standard Contractual Clauses, with the supplementary safeguards required by Articles 44 ff. GDPR.

• Order data and accounting records: ten years, as required by Italian tax and civil law.
• Contact details used for customer care: for as long as needed to handle the request, and twelve months afterwards.
• Email address for the newsletter: for as long as you remain subscribed. After unsubscribing we keep only the record of the withdrawal.

If you subscribe, we use your address to send you news about our models, our craft and what FlyStep is doing. You can unsubscribe at any time from the link at the foot of every email, or by writing to us. Withdrawal does not affect the lawfulness of processing carried out beforehand.

At any time you may request access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. You may also withdraw the consent given for the newsletter.

An email to flystep.general@gmail.com is enough. We reply within one month of the request.

If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or bring the matter before a court.

We carry out no profiling and take no automated decisions producing legal effects concerning you.

This notice may be updated. The version in force is always the one published on this page, with the date of last update shown at the bottom.